Security Policy

1. Overview

Nunmathi Technologies Pvt Ltd ("Nunmathi", "we", "us", or "our"), incorporated in Coimbatore, India, is committed to protecting the security, confidentiality, and integrity of all data entrusted to us by our customers, partners, and employees. This Security Policy describes our organisational and technical security practices and the controls we maintain to safeguard the Nunmathi platform and the data it processes.

Security is a foundational concern at Nunmathi — not an afterthought. We follow a defence-in-depth philosophy, combining multiple overlapping security controls at every layer of our technology stack to minimise the impact of any single point of failure. We continuously review and improve our security posture in response to evolving threats, regulatory requirements, and industry best practices.

This document is intended to give our customers and partners confidence in the security of our platform. More detailed technical documentation is available to enterprise customers under a non-disclosure agreement (NDA) upon request. For security vulnerability reports, please refer to Section 12 (Responsible Disclosure).

Security Standards & Certifications

Nunmathi aligns its security programme with leading international standards and is actively pursuing certifications as part of our ongoing compliance roadmap.

2. Infrastructure Security

The Nunmathi platform is hosted on industry-leading cloud infrastructure providers that maintain their own rigorous physical and logical security controls, including ISO 27001, SOC 2 Type II, and PCI DSS certifications. Our infrastructure is architected with security and resilience as primary design principles.

Network Segmentation

Production, staging, and development environments are logically separated using dedicated Virtual Private Clouds (VPCs) with strict network access controls. Internal services communicate over private networks and are never exposed directly to the public internet. Public-facing services are placed behind a Web Application Firewall (WAF) and DDoS protection layer.

Hardened System Configuration

• All server instances are deployed from hardened base images that have been configured in accordance with CIS Benchmarks, with unnecessary services, ports, and protocols disabled.
• Infrastructure is managed as code (IaC) using version-controlled configuration management tools to ensure consistency and auditability.
• Immutable infrastructure principles are applied where possible — servers are replaced rather than patched in-place to reduce configuration drift.
• Container workloads run in isolated environments with minimal privilege and are scanned for known vulnerabilities before deployment.

DDoS Protection

Our platform is protected by network-level and application-level DDoS mitigation services that automatically detect and absorb volumetric, protocol, and application-layer attacks. Traffic anomaly detection is active at all times and will trigger automatic rate limiting and traffic scrubbing when attack patterns are identified.

3. Encryption in Transit

All data transmitted between your browser or application and the Nunmathi platform is encrypted in transit using modern, industry-standard protocols. We do not support deprecated or insecure transport protocols.

• TLS version — All external connections are protected by TLS 1.2 or TLS 1.3. TLS 1.0 and TLS 1.1 are explicitly disabled on all endpoints.
• Cipher suites — Only strong, forward-secret cipher suites are accepted. Weak ciphers including RC4, 3DES, and export-grade ciphers are disabled.
• HSTS — HTTP Strict Transport Security (HSTS) with a minimum max-age of one year is enforced on all production domains to prevent SSL stripping attacks.
• Certificate management — TLS certificates are issued by trusted Certificate Authorities, rotated regularly, and monitored for expiry. Certificate Transparency (CT) logs are monitored for unauthorised certificate issuance.
• Internal service communication — All inter-service communication within our infrastructure is encrypted using mTLS (mutual TLS), ensuring that both the client and server authenticate each other before exchanging data.
• API security — All API endpoints are served exclusively over HTTPS. Plain HTTP connections are automatically redirected to HTTPS.

4. Encryption at Rest

All customer data stored on the Nunmathi platform is encrypted at rest using strong cryptographic algorithms. Encryption at rest protects data in the event of unauthorised physical access to storage media.

• Algorithm — AES-256 encryption is applied to all data at rest, including databases, object storage, and backup archives.
• Database encryption — Production databases use Transparent Data Encryption (TDE) at the storage engine level, supplemented by column-level encryption for highly sensitive fields such as API keys, tokens, and personal identification data.
• Object storage — All files, model outputs, and user-uploaded assets stored in object storage are encrypted at rest using server-side encryption with keys managed through a dedicated Key Management Service (KMS).
• Key management — Encryption keys are managed through a dedicated KMS with hardware security module (HSM) backing. Keys are rotated on a defined schedule. Key access is restricted, logged, and audited.
• Backup encryption — All backup copies are encrypted using the same standards as production data. Backup encryption keys are stored separately from the backups themselves.
• End-of-life media — Storage media that has reached end-of-life is wiped using NIST 800-88-compliant methods before disposal or destruction. Physical destruction certificates are obtained for media that cannot be reliably wiped.

5. Access Controls & MFA

Access to customer data and production systems is strictly controlled and granted on a need-to-know, least-privilege basis. We apply the principle of least privilege consistently across all layers of the system.

Customer Account Access

• Multi-factor authentication (MFA) is available for all customer accounts and is strongly recommended. Enterprise plans may enforce MFA as a mandatory policy for all users in their organisation.
• Passwords are hashed using bcrypt with a work factor of 12 or higher. We do not store plaintext passwords.
• Single Sign-On (SSO) via SAML 2.0 and OpenID Connect (OIDC) is supported for enterprise customers, enabling integration with existing identity providers such as Okta, Microsoft Entra ID (Azure AD), and Google Workspace.
• API keys and service tokens are generated with cryptographic randomness, are scoped to specific permissions, and can be revoked at any time from the account dashboard.
• Session tokens have configurable expiry periods and are invalidated upon password change or explicit logout.

Role-Based Access Control (RBAC)

Our platform implements granular RBAC, allowing organisation administrators to define precise permissions for each team member. Permissions can be scoped to specific projects, data sets, or API capabilities. Access reviews are recommended quarterly to ensure that permission assignments remain appropriate.

6. Monitoring & Logging

We operate comprehensive monitoring and logging systems to detect anomalous behaviour, security incidents, and operational issues in real time.

• Centralised logging — All application, infrastructure, and security events are forwarded to a centralised, tamper-evident log management system with a minimum retention period of twelve (12) months.
• Security Information and Event Management (SIEM) — Our SIEM platform continuously correlates log data across all systems to identify suspicious patterns, policy violations, and potential security incidents.
• Intrusion detection — Host-based (HIDS) and network-based (NIDS) intrusion detection systems are deployed to identify and alert on known attack signatures and anomalous behaviour.
• Uptime monitoring — Availability of all customer-facing services is monitored continuously with automated alerting and paging for any degradation or outage.
• Alerting and on-call — Our security and engineering teams operate a 24/7 on-call rotation for critical security and availability alerts.
• Audit trails — All administrative actions taken on customer data — including access, modification, deletion, and export — are logged with timestamps, user identifiers, and source IP addresses.

7. Vulnerability Management

We maintain a continuous vulnerability management programme to identify, assess, prioritise, and remediate security weaknesses in our technology stack.

• Dependency scanning — All third-party software dependencies are scanned for known vulnerabilities (CVEs) on every build using automated tools integrated into our CI/CD pipeline. Critical and high-severity vulnerabilities trigger mandatory review before deployment.
• Container image scanning — Docker images are scanned for vulnerabilities before being pushed to our container registry. Images with critical vulnerabilities are blocked from deployment.
• Static Application Security Testing (SAST) — Automated SAST tools analyse our source code for common security flaws on every pull request.
• Dynamic Application Security Testing (DAST) — DAST scans are run against staging environments on a regular schedule to identify runtime vulnerabilities.
• Patch management — Critical operating system and application security patches are applied within seventy-two (72) hours of release. High-severity patches are applied within seven (7) days. All patches are tracked in our vulnerability management system.
• Vulnerability SLAs — Critical vulnerabilities: remediated within 24 hours. High: 7 days. Medium: 30 days. Low: 90 days. SLA breaches are escalated to senior management.

8. Penetration Testing

Nunmathi engages qualified independent security firms to conduct penetration tests of the platform at least once per year, with additional targeted tests conducted following significant architecture changes or new feature releases.

• Scope — Annual penetration tests cover the full application stack including web applications, APIs, mobile applications, and network infrastructure. Tests are conducted in both authenticated and unauthenticated contexts.
• Methodology — Tests follow OWASP Testing Guide, PTES (Penetration Testing Execution Standard), and NIST SP 800-115 methodologies, covering OWASP Top 10 vulnerabilities, authentication weaknesses, authorisation flaws, injection attacks, and logic vulnerabilities.
• Remediation — All findings are triaged and remediated according to our vulnerability SLAs (see Section 7). Critical and high findings are addressed before the report is considered closed.
• Reports — Penetration test executive summaries are available to enterprise customers under NDA upon request. Raw reports containing exploitation details are not shared externally.
• Bug bounty — We encourage responsible disclosure by security researchers through the process described in Section 12. We do not currently operate a public bug bounty programme but intend to launch one in 2027.

9. Backup & Disaster Recovery

Nunmathi maintains a comprehensive backup and disaster recovery programme to ensure that customer data can be recovered and services can be restored in the event of a catastrophic failure.

Backup Strategy

• Frequency — Production databases are backed up continuously using incremental write-ahead log (WAL) streaming, with full daily snapshots taken at off-peak hours.
• Retention — Daily backups are retained for thirty (30) days. Weekly backups are retained for ninety (90) days. Monthly backups are retained for one (1) year.
• Geographic distribution — Backups are stored in geographically separate regions from the primary data, ensuring that a regional outage does not affect backup availability.
• Verification — Backup integrity is verified automatically after each backup operation. Full restore tests are conducted quarterly to confirm that backups are viable and recovery procedures are effective.

Recovery Objectives

Business Continuity

Our Business Continuity Plan (BCP) is reviewed and tested annually. It covers procedures for operating the business and restoring services in the event of extended outages, natural disasters, key personnel unavailability, and supply-chain disruptions. Critical dependencies are identified and alternative suppliers are maintained where feasible.

10. Incident Response

Nunmathi operates a documented Incident Response Plan (IRP) to ensure that security incidents are handled promptly, systematically, and transparently.

Incident Classification

• P1 — Critical: Material data breach, ransomware, or service-wide outage. Immediate escalation; all-hands response.
• P2 — High: Limited data exposure, partial service degradation, or suspected compromise of a single system.
• P3 — Medium: Policy violations, failed attack attempts, or single-user account compromises.
• P4 — Low: Minor anomalies or informational security events requiring monitoring.

Response Process

• Detection & triage — Incidents are identified through automated monitoring, employee reports, or third-party notifications. All suspected incidents are logged in our incident management system within one (1) hour of detection.
• Containment — Affected systems are isolated to prevent the spread of a compromise. Access credentials associated with compromised accounts are revoked immediately.
• Eradication — The root cause is identified and eliminated. Compromised systems are rebuilt from clean images rather than patched in-place where feasible.
• Recovery — Services are restored from verified clean backups or rebuilt infrastructure. Recovery is validated before returning to production.
• Post-incident review — A blameless post-mortem is conducted within five (5) business days of incident resolution. Lessons learned are documented and incorporated into preventive controls.

Customer Notification

In the event of a confirmed security breach that affects your data, we will notify you without undue delay and within seventy-two (72) hours of becoming aware of the breach, as required by applicable data protection law. Our notification will include a description of the nature of the breach, the categories and approximate number of individuals affected, the likely consequences, and the measures taken or proposed to address the breach.

11. Employee Access Controls

Access to customer data by Nunmathi employees is strictly controlled, monitored, and governed by formal policies. We apply the principle of least privilege and need-to-know across the entire organisation.

• Background checks — All employees and contractors with access to production systems or customer data are subject to background verification prior to being granted access.
• Security training — All employees undergo mandatory security awareness training on joining and annually thereafter. Phishing simulation exercises are conducted quarterly.
• Access provisioning — Access to production systems is granted through a formal provisioning process requiring manager approval and documented business justification. Access is reviewed and revalidated quarterly.
• Privileged access management — Administrative access to production systems is managed through a Privileged Access Management (PAM) solution. All privileged sessions are recorded and reviewed.
• MFA for employees — MFA is mandatory for all employee access to production systems, internal tools, email, and corporate applications. Hardware security keys (FIDO2) are the preferred second factor for privileged accounts.
• Device management — All employee devices used to access Nunmathi systems are enrolled in Mobile Device Management (MDM). Devices must have full-disk encryption enabled, up-to-date operating systems, and approved endpoint security software.
• Offboarding — Access to all systems is revoked within four (4) hours of an employee's departure. Departing employees are required to return all company devices and sign off on data handling obligations.
• Production access audit — All direct access to production customer data by Nunmathi employees is logged, and logs are reviewed by the security team. Routine customer support does not require direct database access.

12. Responsible Disclosure

Nunmathi values the work of the security research community and is committed to working with researchers who identify vulnerabilities in our platform in a responsible manner. We ask that you follow the guidelines below when disclosing a potential security issue.

Reporting a Vulnerability

Please report security vulnerabilities by email to info@nunmathi.com with the subject line "Security Vulnerability Report". We encourage you to encrypt sensitive reports using our PGP key (available on request). Your report should include:

• A clear description of the vulnerability and its potential impact.
• Detailed steps to reproduce the issue, including proof-of-concept code, URLs, or screenshots where applicable.
• The systems, versions, or endpoints affected.
• Your contact information so we can reach you for follow-up.

Responsible Disclosure Guidelines

• Do not access, modify, or delete data belonging to other users beyond what is minimally necessary to demonstrate the vulnerability.
• Do not conduct automated vulnerability scanning that may affect platform performance or availability.
• Do not publicly disclose a vulnerability before we have had a reasonable opportunity to investigate and remediate it (coordinated disclosure). We request a minimum of ninety (90) days before public disclosure.
• Do not use social engineering, phishing, or physical attacks against Nunmathi employees or infrastructure.

13. Contact

For security-related enquiries, vulnerability reports, or questions about this Security Policy, please contact our Security team:

• Company: Nunmathi Technologies Pvt Ltd
• Registered Office: Coimbatore, Tamil Nadu, India
• Email: info@nunmathi.com
• Subject line (general): Security Policy Enquiry
• Subject line (vulnerabilities): Security Vulnerability Report

Security vulnerability reports are triaged with priority. We aim to acknowledge all reports within twenty-four (24) hours. For urgent security concerns, please mark your email as "Urgent — Security" in the subject line.